MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978
SHA3-384 hash: 6c5da53b5eeb69440a4b534d02e6966313c157434253f67b403f69f5fe0c7e15fc85298b1007b553a09763d370465a41
SHA1 hash: e58b71350e66213cb9c4f67b675d27a1bc5c0547
MD5 hash: 422e4eba00b24dfde1a5f43055204385
humanhash: three-lemon-charlie-fruit
File name:44313,6048108796.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:800'768 bytes
First seen:2021-04-29 16:14:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 826b8583e9b3c846c8b3c651780f2bd2 (2 x Quakbot)
ssdeep 12288:l50YpKf2Y/wNB+hu8BF2Vk3No+xq7pZ/3F8tTdxcb/7Ry251RvZcCELcmRB3:l50cKF4LoxRyUCZx51RvGb4mRB
Threatray 1'351 similar samples on MalwareBazaar
TLSH 8C05AD707153C136D2726E35CD0AE5FD1A817C1AEF2A180B36D23FAFBB351614A36269
Reporter JasonMilletary
Tags:Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/146775/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=djl52mc23mnoire2bovj5z3kdn4uo7l6pljyammufhzc7spjnf4a._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
2386cf963dc70f9e148125608ab62b1c9d25a04b8a9baa190bd542b2266702ee
Quakbot
3a50ed28be3ab77b92f1bce16b8328baeff0eec46aed4c45e53de9d64fd66b4a
Quakbot
53bd776c525c7f8998d2504fdd2454819267d9f4eb5c1ca53b9388ce5dfcdcff
Quakbot
78b8df6b5b360e6237b84a915c210d40c10ac7959f7181db8b3c84da0c745682
Quakbot
8ff3397c5cc8c866d6c1f492ccfe88f39b3b968757a3b3c9400d85f8ca0aba55
Quakbot
98a062850c6a8381bfc18fc967506bf71721ae6c4301a1a2894dddbf49bfc01c
Quakbot
a3658ba64eb500732cdfa46722ec26afda720f75d12b3425bc3c164ec0e8ec5e
Quakbot
a7ea628bdfde1435a4b8a1562e43cd960fcd9a98e65dfd6a81cbd1603ba9be1e
Quakbot
d0fb60a27104386f56e8062cbe2bc245057122ec27c383c187429351a32f4a18
Quakbot
e0b62cc5d8460d9854b733f65a76ec9325aeebadb50e68ef1755b2cbe7ec9fe4
Quakbot
+ 1'341 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210429-z4djg7sphe/
Unpacked files
SH256 hash:
c14bddd117816a7c9b272405deb638348f87876a6d88cc4a345d322353229a05
MD5 hash:
a21425b2c2ed615ee0f32576b983a934
SHA1 hash:
736a0353c19e2767acebe983352799ea10e6aa7c
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/4d429588-350c-451b-bb03-6ba259024d41/
SH256 hash:
1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978
MD5 hash:
422e4eba00b24dfde1a5f43055204385
SHA1 hash:
e58b71350e66213cb9c4f67b675d27a1bc5c0547
Link:
https://www.unpac.me/results/4d429588-350c-451b-bb03-6ba259024d41/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/146775/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-29 17:04:30 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0052] File System Micro-objective::Writes File
1) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
2) [C0040] Process Micro-objective::Allocate Thread Local Storage
3) [C0041] Process Micro-objective::Set Thread Local Storage Value
4) [C0018] Process Micro-objective::Terminate Process